tailwind-form-templates

{"modified":"2026-08-12T15:41:57Z","published":"2026-08-12T15:41:57Z","schema_version":"1.7.4","id":"MAL-2026-13923","summary":"Malicious code in tailwind-form-templates (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8febe917c3076e12756acd284d92cd2810cb59f7c546a6e669ef23caa56457bc)\nThe package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, appending an `eval(atob(...))` payload that runs on require(). The decoded payload obfuscates its strings via \\uXXXX escapes and dynamically requires http/https and child_process. At import time it queries Ethereum public RPCs and eth.blockscout.com/api for transactions from a hardcoded wallet (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), decodes an attacker-controlled IPv4 address from a transaction's `to` field, fetches an XOR-encrypted command from that IP via an `x-payload-b64` header, and executes the result through `eval` and a detached `spawn('node', ['-e',...])`. This is a full-host remote code execution channel on the installer, with the C2 endpoint rotatable via on-chain transactions (EtherHiding pattern) and the malicious code grafted onto a legitimate library to evade casual review.\n","affected":[{"package":{"ecosystem":"npm","name":"tailwind-form-templates"},"versions":["0.7.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"83a0b7b595bdc1fd9927844f8eea61723d6b4a93b0867498bb878d47f2919fd0","tlsh":"6292a55b5112366fef1b193af8cbab9823285072a6ec1f80e057d470ab89dc4755f60f"}],"package_integrity":[{"filename":"tailwind-form-templates-0.7.4.tgz","hashes":{"sha1":"8e612359b762bae735774e85b1a42e95075abd60","sha512_sri":"sha512-3BRFu5qXitkEvR/Xi0vN8IU4K05WDreqIqQXWreaIbcIvn8km4i84jkpPhT1uL/o3KVZbz0occnbs+M7TrhI2A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwind-form-templates/v/0.7.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017619","import_time":"2026-08-12T15:53:01.55159181Z","modified_time":"2026-08-12T15:41:57Z","sha256":"8febe917c3076e12756acd284d92cd2810cb59f7c546a6e669ef23caa56457bc","source":"amazon-inspector","versions":["0.7.4"]}]}}